Check: CNTR-R2-000140
Rancher Government Solutions RKE2 STIG:
CNTR-R2-000140
(in versions v2 r2 through v1 r3)
Title
The Kubernetes API server must have the insecure bind address not set. (Cat I impact)
Discussion
By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the "insecure bind" address and is set by default to localhost. Any requests to this address bypass authentication and authorization checks. If this insecure bind address is set to localhost, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place and have full control over the entire cluster. Close or set the insecure bind address by setting the API server's --insecure-bind-address flag to an IP or leave it unset and ensure that the --insecure-bind-port is not set.
Check Content
If running rke2 Kubernetes version > 1.20, this requirement is not applicable (NA). Ensure insecure-bind-address is set correctly. Run the command: ps -ef | grep kube-apiserver If the setting insecure-bind-address is found and set to "localhost", this is a finding.
Fix Text
If running rke2 Kubernetes version > 1.20, this requirement is NA. Upgrade to a supported version of RKE2 Kubernetes.
Additional Identifiers
Rule ID: SV-254560r960792_rule
Vulnerability ID: V-254560
Group Title: SRG-APP-000033-CTR-000095
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000213 |
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
Controls
Number | Title |
---|---|
AC-3 |
Access Enforcement |